snakekeylogger | 94599985eaba6ba050b0be5c1aa3fd3f5bb469190b6a7a9f81d2c930b69bef38

General

Target

39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
Size

298KB
MD5

39d6afe5692079df30e75663f459d0e4
SHA1

6bf764e164447dde5c39b8abbb12288379a69f33
SHA256

94599985eaba6ba050b0be5c1aa3fd3f5bb469190b6a7a9f81d2c930b69bef38
SHA512

73c7a67cd66a7ef03dcd9673773c41c15a0e7bfd328b10c43b61e14d14b392fa79891bcef54f978d5a17364cbf69afa4ea63e35a3b4ab7a841064004d3ef00f2
SSDEEP

6144:XAGQgMkhBJUnPFWByu1tgdMgfh8JJulwz2quwif2U6:gSByPU8ytgNoJulIpuXf2U

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.enche.com
Port:
587
Username:
[email protected]
Password:
Merchandise08012021
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2520-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2520-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2520-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2520-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2520-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2520-20-0x00000000046A0000-0x00000000046E0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
4 checkip.dyndns.org

flow	ioc
8	freegeoip.app
9	freegeoip.app
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

description	pid	process	target process
PID 2744 set thread context of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2324 2520 WerFault.exe 39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

pid process

2520 39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2520 39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

pid	pid_target	process	target process
2324	2520	WerFault.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

pid	process
2520	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2520	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe

description	pid	process	target process
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2744 wrote to memory of 2520	2744	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
PID 2520 wrote to memory of 2324	2520	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	WerFault.exe
PID 2520 wrote to memory of 2324	2520	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	WerFault.exe
PID 2520 wrote to memory of 2324	2520	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	WerFault.exe
PID 2520 wrote to memory of 2324	2520	39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\39d6afe5692079df30e75663f459d0e4_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1616
    3⤵
    - Program crash
    PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-22-0x00000000046A0000-0x00000000046E0000-memory.dmp

Filesize
256KB

Download
memory/2520-21-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2520-20-0x00000000046A0000-0x00000000046E0000-memory.dmp

Filesize
256KB

Download
memory/2520-19-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2520-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2520-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-5-0x0000000001DE0000-0x0000000001E20000-memory.dmp

Filesize
256KB

Download
memory/2744-6-0x0000000004930000-0x000000000497A000-memory.dmp

Filesize
296KB

Download
memory/2744-0-0x00000000000D0000-0x0000000000120000-memory.dmp

Filesize
320KB

Download
memory/2744-18-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2744-4-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2744-3-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2744-2-0x0000000001DE0000-0x0000000001E20000-memory.dmp

Filesize
256KB

Download
memory/2744-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads